Arcube Limited - Privacy and Cookie Notice

Last updated: March 16, 2026.

Background

This notice tells you how we look after your personal data when you visit our website at https://arcube.com/, when you interact with our services, when you work for one of the customers that purchases our technology, or when you interact with us in any other way.

This notice sets out what information we collect about you, what we use it for and who we share it with. It also explains your rights and what to do if you have any concerns about your personal data.

We may sometimes need to update this notice, to reflect any changes to the way the services are provided or to comply with new business practices or legal requirements. You should check this privacy notice to see whether any changes have occurred.

Who we are and other important information

We are Arcube Limited (referred to in this Policy as "we", "us" and "our").

For those who interact with our services, all visitors to our website, the personnel of our customers, ancillary suppliers and other suppliers, and all other individuals with whom we communicate in the course of providing our services or running our business (each referred to as "you" and "your"), we are the controller of your information (which means we decide what information we collect and how it is used).

The types of Personal Data we collect

We collect your information when you interact with our services, visit our website or we otherwise communicate with you in the course of providing our services or running our business. A description of the information we collect, together with how and why we use this information is provided below.

When you engage with Arcube Services

We provide personalised advertising and marketing services. You will interact with these services when an airline ("airline") has engaged with Arcube and has implemented the Arcube services on their website and other communications.

In certain circumstances you will be asked to provide information when you interact with our services. This information is collected and stored by us and may be shared with third parties, as set out in this Privacy Policy or as otherwise notified to you when you provide the information.

We also collect some information automatically when you interact with our services. In some jurisdictions this it classed as Personal Data (please see below for further information about the definition of "Personal Data" in relation to different countries in which we operate). This includes:

IP address
Location
Device type
Browser type
Session ID (generated from a unique identifier for your transaction which is shared with us by the publisher. This session ID allows us to understand how you interact with our advertisers, but without telling us who you are.)
Language preferences
Access times
Airline's website address

The airline will also share information with us regarding any travel or other products and services you have purchased.

The airline may also share with us information (including your email address) so that we can pre-fill your details and save you from providing this information to us again. The airline may share other Personal Data with us, where they elect to do so in their sole discretion.

We do not intentionally collect details about your race, ethnicity, political views, religious or philosophical beliefs, sexual preferences, health, genetics or criminal records, or any other Personal Data that would be considered "Special Category Data" under the GDPR or UK GDPR. If we discover that we have collected Personal Data of this nature, we will delete it as soon as reasonably practicable.

When you visit Arcube's website

In addition to any Personal Data that you provide to us voluntarily, Arcube will collect information about your use of our website, and your IP address, ISP and IP location, internet speed, and browser information.

Business contacts of Arcube

In addition to any Personal Data that you provide to us voluntarily, information may be provided to Arcube by your employer or another person or organisation that has engaged you, where such person or organisation has a relationship with Arcube (e.g. as an airline or supplier).

How Arcube collects your Personal Data

Arcube collects information about you when our website is shown to you following your purchase with the airline, often on the "confirmation page,". On this page you may be presented with ancillary products and services relevant to your purchase with the airline. Similarly, you may see ancillaries promoted in your emails from the airline, for example, when they confirm your order ("Ancillary Promotion"). It is at this time that the airline may pass us Personal Data, and we may collect Personal Data, as described above. We use this data to determine which Ancillary Promotions are most appropriate for you. We may also collect Personal Data from you when you click on an Ancillary Promotion, purchase a product, subscribe to newsletters or other publications, subscribe to marketing communications or agree to be notified of new promotions. We use this Personal Data to determine which Ancillary Promotions are best for you and for the other purposes indicated at the time of purchase. Some of your Personal Data may also be collected via indirect sources. These may include:

From airlines and other clients when we perform our services;
A survey you completed
Responses you've made to a promotion
Through our employees, agents, contractors or suppliers
Third-party service providers
When we are required by law or regulation to do so

Other ways we collect information include via online activity, such as your Internet Protocol (IP) address, through local storage, analytic or advertising "cookies" or digital identifiers, which are usually small lines of text that are stored with your Web browser for record keeping purposes, and which we use to obtain statistical information and to understand what advertising, offers or services may be relevant to you. Your browser, as well as the notice on our website, has options in its security settings to accept, reject or provide you with a notice when a cookie or digital identifier is sent, and you can clear these and disable future use of cookies and digital identifiers if you want to.

Purposes for which Arcube collects and processes your Personal Data

In some jurisdictions in which we collect and use Personal Data (in particular the UK and European Union), we are required to identify a legal justification (also known as a lawful basis) for collecting and using your Personal Data, in addition to describing the purpose.

There are six legal justifications which organisations can rely on. The most relevant of these to us are where we use your Personal Data to:

The table below sets out the specific purposes for which we use your Personal Data and the lawful basis we rely on when we do so. We may state a more specific additional purpose when we collect your Personal Data.

Lawful Basis	Purpose for using your Personal Data
Contract	Where you are a passenger that uses our services and contracts with us as an individual, we will use your Personal Data to: administer or perform our contract with you. process your payment information in connection with any contract we have with you. send you updates about the ancillaries you have bought (e.g. confirmation of order, arrival time). to validate the information you give us. to arrange for the provider of the ancillary to deliver the product or service to you. to send you updates about any of the above.
Legal Obligation	If processing of your Personal Data is necessary: to record your preferences (e.g. marketing) to ensure that we comply with applicable data protection laws. where we retain information to enable us to bring or defend legal claims. where we are required to assist government and law enforcement agencies or regulators, including in relation to any eligible data breach declarations by any of them.
Legitimate Interests	Where using your information is necessary to pursue our legitimate business interests: to administer or perform our contract with airlines and other customers, service providers, data processors, or your business or employer. for marketing and promoting our services. to contact you, for example, to respond to your queries or complaints, or if we need to tell you something important. to perform accounting, billing and other administrative and operational functions. to assess Ancillary Promotions to optimise future marketing campaigns and future marketing strategy. to perform routine analysis on the performance of our services and business more generally, and on our marketing and sales activities. We may anonymise Personal Data before we do this. to enable you to use our website. to improve and optimise our systems, procedures, products, services, Offers widgets and website. to validate users to verify the accuracy of customer data and to reduce fraudulent signups. to monitor and make improvements to our website and services to enhance security and prevent fraud. to create and retain evidential records to validate the provision of consent to direct marketing. to protect our business and defend ourselves against legal claims. Where we use your information for our legitimate interests, we have assessed whether such use is necessary and that such use will not infringe your other rights and freedoms.
Consent	Where you have provided your consent to providing us with information or allowing us to use or share your information: to send you details of promotions and other electronic marketing materials. Please note that there may be instances where refusing to provide your consent where requested will result in us being unable to provide our services. Where you consent to cookies or other similar technologies - see details in our Cookie Policy.

How we hold your Personal Data

At Arcube we have a series of security measures in place to protect your Personal Data.

We use industry-standard encryption to help protect data at rest.

We keep customer information in controlled systems that are protected with authorised access only and prevent copying of your stored Personal Data. We manage and access privileges to ensure the minimal Personal Data that we do store is limited to only those who need access to it for our legitimate business purposes. We also provide continuing training to our staff and regular security reviews.

We have procedures in place to mitigate any security risks or breaches, including penetration testing, but you must keep in mind that no security system is 100% secure and such incidents may occur.

Retention of Personal Data

We will retain your Personal Data for as long as needed to fulfil the purposes for which we collected it and for a reasonable period thereafter in order to comply with audit, contractual, or legal requirements, or where we have a legitimate interest in doing so. This period will typically be 7 years from the date that we last interacted with you or the business by which you were employed or engaged, whichever is later.

We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We may retain aggregated or de-identified data indefinitely or to the extent allowed by applicable data protection laws.

We may retain Personal Data preserved in automatically generated computer back-up or archival copies generated in the ordinary course of our information technology systems procedures.

We are not responsible for the retention periods of airlines or ancillary suppliers.

Who Arcube may share your Personal Data with

From time to time, we may share your Personal Data with other affiliates or subsidiaries of our business group. We may also share your Personal Data with third-parties outside of our organisation for different purposes, including:

Ancillary suppliers for the purpose of fulfilling, and providing you with further information associated with, their products and services, or other purpose explicitly disclosed at the time of collection.
Airlines and other clients, for the purpose of confirming and permitting them to verify the services we provide them, and charges due.
Legal, regulatory or self-regulatory authorities overseeing a complaint or concerns of yours, or a matter involving you.
Vendors and sub-processors we rely on to conduct our business and are necessary for us to be able to provide our services and products, or to detect, prevent, or otherwise address fraud, security or technical issues.
Our professional advisors or contractors, such as our auditors, accountants or lawyers or other professional consultants.
Market research and customer review organisations who can assist us in developing or improving the quality of our services and products.
Software providers we may contract with to promote our services, such as digital advertisement or e-commerce related platform companies.
As part of or in connection with a sale of our business, merger, reorganisation, investment, change in control, transfer of substantial corporate assets, liquidation or similar transaction.
Any authorised government or regulatory or self-regulatory authority or enforcement agency we are required or specifically permitted under law to share your Personal Data with.

Your rights regarding your Personal Data we collect or store

Depending on which jurisdiction you are located in, you may have certain rights related to your access and/or management of your Personal Data stored by us. We have set out below your rights if you are located in certain specific jurisdictions. Please contact us if you would like more information about your rights regarding your Personal Data.

RESIDENTS OF THE EUROPEAN ECONOMIC AREA (EEA), UNITED KINGDOM (UK) OR SWITZERLAND

Under the General Data Protection Regulation (EU) 2016/679) ("GDPR") and the retained version of the same regulation in the UK ("UK GDPR") "Personal Data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Transfers of Personal Data out of the GDPR Area

If you are located in the European Economic Area, the United Kingdom, or Switzerland (the "GDPR Area"), and we transfer your personal data outside the EEA, UK or Switzerland (including where we provide any Personal Data about you to any non-GDPR Area service providers or suppliers) we will take appropriate measures to ensure that the recipient protects your Personal Data adequately in accordance with this Privacy Policy and all applicable EU and UK data protection laws. These measures may include:

Ensuring that there is an adequacy decision in respect of the country to which the Personal Data is being transferred, which means that the applicable authority of the GDPR Area has concluded that the laws and practices of the destination country provide adequate protection for Personal Data.
The use of standard model contractual arrangements with the recipient of Personal Data which have been approved by the European Commission or UK Information Commissioner, as appropriate ("SCCs").
The EU-U.S. Data Privacy Framework ("EU-U.S. DPF") and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework.

Your Rights under the GDPR

If you are a resident of the GDPR Area, and where Arcube is a data controller, your data protection rights are as follows:

You can request access of your Personal Data. You can do so at any time by submitting a request to our email address set out below.
You can ask us to correct your Personal Data if it is inaccurate or incomplete. We might need to verify the new information before we make any changes. You can do so at any time by submitting a request to our email address set out below.
You can ask us to delete or remove your Personal Data if there is no good reason for us to continuing holding it or if you have asked us to stop using it. You can do so at any time by submitting a request to our email address set out below. If we think there is a good reason to keep the information you have asked us to delete (e.g. to comply with regulatory requirements), we will let you know and explain our decision.
You can object to processing of your Personal Data, ask us to restrict processing of your Personal Data or request portability of your Personal Data. You can do so at any time by submitting a request to our email address set out below. If we think there is a good reason to keep using the information or for not complying with your request, we will let you know and explain our decision.
You have the right to opt-out of marketing communications we send to you at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing e-mails we send you.
To opt-out of other forms of marketing, then please contact Arcube using the contact details provided below or by email to our email address set out below.
If Arcube has collected, and currently processes, your Personal Data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Personal Data conducted in reliance on lawful processing grounds other than consent.
You have the right to complain to a data protection authority about Arcube's collection and use of your Personal Data.

Arcube responds to verifiable requests received from individuals who wish to exercise their data protection rights in accordance with applicable data protection laws. When contacting us, please provide us with detailed information about the Personal Data you are requesting we correct, update, amend, or remove, and the timeframe and manner in which you believe we came to collect your Personal Data.

If we obtained your Personal Data from a third-party acting on your behalf, you should contact the company or person you provided your information to.

If we have passed your Personal Data to a third party in accordance with this Privacy Policy (e.g. an ancillary supplier), and you would like to have your Personal Data held by such third party corrected, updated, amended, or removed, please contact the relevant third party directly.

How to contact Arcube about Your Rights

Should you have questions, requests or concerns about your privacy, Arcube can be reached by emailing support@arcube.com. Alternatively you can mail us at: Renold Building, 81 Sackville Street, Manchester, M1 3NJ

Changes to this Privacy Policy

We may update this Privacy Policy at any time to reflect changes to our information practices. We encourage you to periodically review this page for the latest information on our privacy practices.